rcf-lite 0.23.0 → 0.24.0

package/blueprints/edge-cloudflare-turnstile/blueprint.json

@@ -0,0 +1,161 @@
+{
+  "slug": "edge-cloudflare-turnstile",
+  "version": "1.0.0",
+  "category": "edge",
+  "capabilities": [
+    "humanCheck"
+  ],
+  "suggestedCompanions": [
+    {
+      "role": "logging",
+      "reason": "Every siteverify call and every refuse-if-token-missing rejection writes through the applied logger; a logging companion supplies the sink factory."
+    },
+    {
+      "role": "errorHandling",
+      "reason": "A siteverify network failure, a malformed token or a missing sitekey and secret constructs an internal error record; an error-handling companion supplies the record factory and the boundary."
+    },
+    {
+      "role": "secretsManagement",
+      "reason": "The paired TURNSTILE_SITEKEY and TURNSTILE_SECRET are stored in the operator applied secretsManagement companion; the applied vault seam receives the elicited values at apply time and injects them at deploy."
+    }
+  ],
+  "elicits": [
+    {
+      "id": "turnstile-sitekey",
+      "prompt": "Cloudflare Turnstile sitekey the widget renders with. See https://developers.cloudflare.com/turnstile/ for issuing. Test sitekeys are pinned in the shipped fixture per https://developers.cloudflare.com/turnstile/troubleshooting/testing/.",
+      "kind": "string",
+      "default": ""
+    },
+    {
+      "id": "turnstile-secret",
+      "prompt": "Cloudflare Turnstile secret the server-side verifier posts to siteverify with. Never inline; stored via the applied secretsManagement companion or your environment.",
+      "kind": "string",
+      "default": ""
+    },
+    {
+      "id": "turnstile-widget-mode",
+      "prompt": "Cloudflare Turnstile widget mode per ADR-3602 and https://developers.cloudflare.com/turnstile/. managed (recommendedDefault; Cloudflare decides when to show the challenge); non-interactive (always shows a non-interactive challenge); invisible (mounts an invisible widget).",
+      "kind": "enum",
+      "options": [
+        "managed",
+        "non-interactive",
+        "invisible"
+      ],
+      "default": "managed"
+    },
+    {
+      "id": "turnstile-guarded-surfaces",
+      "prompt": "List of applied route ids the token-required guard registers on. Every guarded surface refuses missing-token submits with 400 before any downstream handler runs.",
+      "kind": "string",
+      "default": ""
+    }
+  ],
+  "contributions": [
+    {
+      "id": "edge-cloudflare-turnstile-REQ-001",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-turnstile-req-001.json"
+    },
+    {
+      "id": "edge-cloudflare-turnstile-REQ-002",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-turnstile-req-002.json"
+    },
+    {
+      "id": "edge-cloudflare-turnstile-REQ-003",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-turnstile-req-003.json"
+    },
+    {
+      "id": "edge-cloudflare-turnstile-REQ-004",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-turnstile-req-004.json"
+    },
+    {
+      "id": "edge-cloudflare-turnstile-REQ-005",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-turnstile-req-005.json"
+    },
+    {
+      "id": "edge-cloudflare-turnstile-US-35101",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-turnstile-us-35101.json"
+    },
+    {
+      "id": "edge-cloudflare-turnstile-US-35102",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-turnstile-us-35102.json"
+    },
+    {
+      "id": "edge-cloudflare-turnstile-US-35103",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-turnstile-us-35103.json"
+    },
+    {
+      "id": "edge-cloudflare-turnstile-US-35104",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-turnstile-us-35104.json"
+    },
+    {
+      "id": "edge-cloudflare-turnstile-US-35105",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-turnstile-us-35105.json"
+    },
+    {
+      "id": "edge-cloudflare-turnstile-US-35106",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-turnstile-us-35106.json"
+    },
+    {
+      "id": "edge-cloudflare-turnstile-US-35107",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-turnstile-us-35107.json"
+    },
+    {
+      "id": "edge-cloudflare-turnstile-US-35108",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-turnstile-us-35108.json"
+    },
+    {
+      "id": "TAC-3601-edge-cloudflare-turnstile-widget-mount",
+      "kind": "tac",
+      "path": "tacs/tac-3601-edge-cloudflare-turnstile-widget-mount.json"
+    },
+    {
+      "id": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
+      "kind": "tac",
+      "path": "tacs/tac-3602-edge-cloudflare-turnstile-server-verifier.json"
+    },
+    {
+      "id": "TAC-3603-edge-cloudflare-turnstile-magic-link-hook",
+      "kind": "tac",
+      "path": "tacs/tac-3603-edge-cloudflare-turnstile-magic-link-hook.json"
+    },
+    {
+      "id": "ADR-3601-edge-cloudflare-turnstile-verifier-contract",
+      "kind": "adr",
+      "path": "adrs/adr-3601-edge-cloudflare-turnstile-verifier-contract.json",
+      "scope": "global",
+      "topic": "humanVerificationGate",
+      "recommendedDefault": true,
+      "elicited": false,
+      "standardsTraceClause": "Cloudflare Turnstile siteverify endpoint documented shape"
+    },
+    {
+      "id": "ADR-3602-edge-cloudflare-turnstile-widget-mode",
+      "kind": "adr",
+      "path": "adrs/adr-3602-edge-cloudflare-turnstile-widget-mode.json",
+      "recommendedDefault": true,
+      "elicited": true,
+      "standardsTraceClause": "Cloudflare Turnstile documented widget modes"
+    },
+    {
+      "id": "ADR-3603-edge-cloudflare-turnstile-refuse-shape",
+      "kind": "adr",
+      "path": "adrs/adr-3603-edge-cloudflare-turnstile-refuse-shape.json",
+      "recommendedDefault": true,
+      "elicited": false,
+      "standardsTraceClause": "Cloudflare Turnstile documented error codes"
+    }
+  ]
+}

package/blueprints/edge-cloudflare-turnstile/contributions/adrs/adr-3601-edge-cloudflare-turnstile-verifier-contract.json

@@ -0,0 +1,14 @@
+{
+  "adrId": "ADR-3601-edge-cloudflare-turnstile-verifier-contract",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Human verification gate: Cloudflare Turnstile with server-side siteverify (scope global, new topic humanVerificationGate)",
+  "context": "An applying project that mounts a public-facing form (contact, subscribe, magic-link mint, low-cost-per-request public API) needs a human verification gate that keeps unattended bots off the form. Cloudflare Turnstile is the CF-native answer: a client widget that emits a response token and a server-side siteverify endpoint (https://challenges.cloudflare.com/turnstile/v0/siteverify) that returns success:true or success:false with error-codes per https://developers.cloudflare.com/turnstile/. Every applied Worker needs one project-wide answer to the humanVerificationGate topic; a future non-Cloudflare sibling (hCaptcha, reCAPTCHA) would conflict on the same topic by design.",
+  "decision": "The shipped v1.0.0 default is Cloudflare Turnstile with server-side siteverify. The verifier POSTs {secret, response} to https://challenges.cloudflare.com/turnstile/v0/siteverify per the Cloudflare Turnstile documented endpoint shape. On success:true the handler proceeds; on success:false the handler rejects 400 with the error-codes value in the refusal body. The humanVerificationGate topic scope is global on this blueprint; the topic string is humanVerificationGate (lower camel case, one concept per topic, no version suffix). Standards trace clause: Cloudflare Turnstile siteverify endpoint documented shape.",
+  "consequences": "The applying project inherits Cloudflare Turnstile documented widget-and-siteverify contract per https://developers.cloudflare.com/turnstile/. A future hCaptcha or reCAPTCHA sibling contributes the same humanVerificationGate topic with a different answer, forcing a DELIBERATE operator-resolved conflict at the project ADR level. The pack fixture pins Cloudflare public test keys per https://developers.cloudflare.com/turnstile/troubleshooting/testing/ so the pack does not need real Turnstile credentials to run.",
+  "alternativesConsidered": [],
+  "createdAt": "2026-09-07T20:00:00.000Z",
+  "updatedAt": "2026-09-07T20:00:00.000Z"
+}

package/blueprints/edge-cloudflare-turnstile/contributions/adrs/adr-3602-edge-cloudflare-turnstile-widget-mode.json

@@ -0,0 +1,14 @@
+{
+  "adrId": "ADR-3602-edge-cloudflare-turnstile-widget-mode",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Widget mode is elicited as an enum (managed, non-interactive, invisible); recommendedDefault managed",
+  "context": "Cloudflare Turnstile documents three widget modes per https://developers.cloudflare.com/turnstile/: managed (Cloudflare decides when to show a challenge, minimising user friction), non-interactive (always renders a non-interactive challenge for uniform behaviour) and invisible (mounts an invisible widget). Each mode is a per-surface operational profile; the elicit forces the operator to name the intent.",
+  "decision": "Widget mode is elicited (elicited: true). Values: managed, non-interactive, invisible per Cloudflare Turnstile documented modes. recommendedDefault: managed. The applied-sidecar records the operator answer per applying surface. Standards trace clause: Cloudflare Turnstile documented widget modes.",
+  "consequences": "The elicitation forces an explicit answer on every apply. The pack fixture accepts ?mode=<managed|non-interactive|invisible> and pins the invisible-widget test sitekeys (1x00000000000000000000BB and 2x00000000000000000000BB per https://developers.cloudflare.com/turnstile/troubleshooting/testing/) alongside the managed pass/fail sitekeys so every mode is exercised on the gate.",
+  "alternativesConsidered": [],
+  "createdAt": "2026-09-07T20:00:00.000Z",
+  "updatedAt": "2026-09-07T20:00:00.000Z"
+}

package/blueprints/edge-cloudflare-turnstile/contributions/adrs/adr-3603-edge-cloudflare-turnstile-refuse-shape.json

@@ -0,0 +1,14 @@
+{
+  "adrId": "ADR-3603-edge-cloudflare-turnstile-refuse-shape",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Refuse-if-token-missing status is 400 with an error-code body (no sitekey leak); siteverify failure carries the documented error-codes value",
+  "context": "Cloudflare Turnstile siteverify returns {success: false, error-codes: [...]} on failure per https://developers.cloudflare.com/turnstile/. The applying project needs a stable refusal shape that never leaks the sitekey, the secret or the response token into an error body or event record.",
+  "decision": "Refuse-if-token-missing status is 400. Refusal body carries a stable error-code: turnstile.token-missing for the guard branch, or the Cloudflare error-codes[0] for the siteverify-failure branch. Refusal body never carries the sitekey, the secret or the response token value. Standards trace clause: Cloudflare Turnstile documented error codes.",
+  "consequences": "The 400 status is machine-observable at every applied surface; downstream observability records the outcome by error-code, not by sitekey. Event records ship {sitekeyHash, outcome, timestamp} only; the event-secrecy probe asserts this shape (AC-35108-1).",
+  "alternativesConsidered": [],
+  "createdAt": "2026-09-07T20:00:00.000Z",
+  "updatedAt": "2026-09-07T20:00:00.000Z"
+}

package/blueprints/edge-cloudflare-turnstile/contributions/probes/event-secrecy.mjs

@@ -0,0 +1,51 @@
+// Probe: every event record carries sitekeyHash, outcome and timestamp only; never the token, never the secret.
+// anchorAcId: AC-35108-1. accountBound: false. Drives one pass and one fail through the live siteverify endpoint.
+
+export const anchorAcId = 'AC-35108-1';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const { TEST_SECRETS, TEST_SITEKEYS, bootFixture } = await import('./probe-utils.mjs');
+  const results = [];
+
+  const fixture = await bootFixture({ TURNSTILE_SECRET: TEST_SECRETS.alwaysPass, TURNSTILE_SITEKEY: TEST_SITEKEYS.alwaysPass, TURNSTILE_FAIL_SECRET: TEST_SECRETS.alwaysFail });
+  try {
+    await fetch(`${fixture.url}/api/events/clear`, { method: 'POST' });
+    // Pass branch: submit with any token.
+    const passBody = new URLSearchParams();
+    passBody.set('email', 'reviewer@example.com');
+    passBody.set('turnstile-sitekey', TEST_SITEKEYS.alwaysPass);
+    passBody.set('cf-turnstile-response', 'PASS-TOKEN-LITERAL-XYZ');
+    const passResp = await fetch(`${fixture.url}/api/submit`, {
+      method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: passBody,
+    });
+
+    // Fail branch: submit with fail-secret=1 forcing the always-fail secret path.
+    const failBody = new URLSearchParams();
+    failBody.set('email', 'reviewer@example.com');
+    failBody.set('turnstile-sitekey', TEST_SITEKEYS.alwaysBlock);
+    failBody.set('cf-turnstile-response', 'FAIL-TOKEN-LITERAL-ABC');
+    const failResp = await fetch(`${fixture.url}/api/submit?fail-secret=1`, {
+      method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: failBody,
+    });
+
+    const events = await (await fetch(`${fixture.url}/api/events`)).json();
+    const allowed = new Set(['sitekeyHash', 'outcome', 'timestamp']);
+    const extraKeyRecords = events.filter((r) => Object.keys(r).some((k) => !allowed.has(k)));
+    const forbiddenSubstrings = ['PASS-TOKEN-LITERAL-XYZ', 'FAIL-TOKEN-LITERAL-ABC', TEST_SECRETS.alwaysPass, TEST_SECRETS.alwaysFail];
+    const serialized = JSON.stringify(events);
+    const leaks = forbiddenSubstrings.filter((s) => serialized.includes(s));
+    const outcomes = events.map((e) => e.outcome).sort();
+    const shapeOk = events.length === 2 && extraKeyRecords.length === 0 && leaks.length === 0
+      && outcomes[0] === 'refused' && outcomes[1] === 'verified';
+    results.push({
+      anchorAcId: 'AC-35108-1',
+      verdict: shapeOk ? 'pass' : 'fail',
+      detail: shapeOk
+        ? `event-secrecy: 2 events captured, keys=[sitekeyHash,outcome,timestamp] only; no token or secret leak; outcomes=${JSON.stringify(outcomes)}; passResp=${passResp.status} failResp=${failResp.status}`
+        : `event-secrecy failure: events=${events.length} extraKeyRecords=${JSON.stringify(extraKeyRecords)} leaks=${JSON.stringify(leaks)} outcomes=${JSON.stringify(outcomes)} passResp=${passResp.status} failResp=${failResp.status}`,
+    });
+  } finally { await fixture.stop(); }
+
+  return { results };
+}

package/blueprints/edge-cloudflare-turnstile/contributions/probes/guard-shape-scan.mjs

@@ -0,0 +1,48 @@
+// Probe: every elicited surface in the pack fixture source registers under the token-required guard;
+// a live missing-token submit is refused with 400 before any downstream handler runs.
+// anchorAcId: AC-35104-1. accountBound: false.
+
+export const anchorAcId = 'AC-35104-1';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const { FIXTURE_DIR, bootFixture, fixturePost, readFileText } = await import('./probe-utils.mjs');
+  const { resolve } = await import('node:path');
+  const results = [];
+
+  // 1. Source scan: server.js must register the guard on every guarded surface.
+  const serverSrc = await readFileText(resolve(FIXTURE_DIR, 'server.js'));
+  // The guard is the tokenRequiredGuard function; every POST route on a guarded surface must call it.
+  const guardedSurfacesPattern = /GUARDED_SURFACES/;
+  const guardCallPattern = /tokenRequiredGuard\(req, res, params\)/;
+  const surfaceCheckPattern = /if \(!GUARDED_SURFACES\.includes/;
+  const hasGuardedSurfaces = guardedSurfacesPattern.test(serverSrc);
+  const hasGuardCall = guardCallPattern.test(serverSrc);
+  const hasSurfaceCheck = surfaceCheckPattern.test(serverSrc);
+  const scanOk = hasGuardedSurfaces && hasGuardCall && hasSurfaceCheck;
+  results.push({
+    anchorAcId: 'AC-35104-1',
+    verdict: scanOk ? 'pass' : 'fail',
+    detail: scanOk
+      ? 'guard-shape scan: GUARDED_SURFACES declared, tokenRequiredGuard called on POST handlers, surface-check gate present before guard call'
+      : `guard-shape scan miss: GUARDED_SURFACES=${hasGuardedSurfaces}, guardCall=${hasGuardCall}, surfaceCheck=${hasSurfaceCheck}`,
+  });
+
+  // 2. Live refuse: missing-token POST to every guarded surface returns 400 with turnstile.token-missing.
+  const fixture = await bootFixture();
+  try {
+    for (const path of ['/api/submit', '/api/magic-link']) {
+      const resp = await fixturePost(fixture.url, path, { email: 'reviewer@example.com', 'turnstile-sitekey': '1x00000000000000000000AA' });
+      const ok = resp.status === 400 && resp.json && resp.json.errorCode === 'turnstile.token-missing';
+      results.push({
+        anchorAcId: 'AC-35104-1',
+        verdict: ok ? 'pass' : 'fail',
+        detail: ok
+          ? `guard rejected missing-token submit on ${path} with status=400 errorCode=turnstile.token-missing`
+          : `guard unexpected shape on ${path} status=${resp.status} body=${resp.text}`,
+      });
+    }
+  } finally { await fixture.stop(); }
+
+  return { results };
+}

package/blueprints/edge-cloudflare-turnstile/contributions/probes/probe-utils.mjs

@@ -0,0 +1,139 @@
+// Shared helpers for edge-cloudflare-turnstile probes.
+//
+// Runtime-dependency posture: probes drive the shipped pack fixture at
+// packages/rcf-lite/test/fixtures/probe-pack-edge-cloudflare-turnstile so
+// rcf-lite gains no new runtime dependency (Node's built-in http, url and
+// crypto modules cover the fixture). Two probes are pure source-tree AST
+// scans (secret-shape-scan, guard-shape-scan); two probes drive the live
+// https://challenges.cloudflare.com/turnstile/v0/siteverify endpoint with
+// the pinned Cloudflare public test keys documented at
+// https://developers.cloudflare.com/turnstile/troubleshooting/testing/
+// (siteverify-fixture, event-secrecy).
+
+import { mkdir, writeFile, readFile, readdir, stat } from 'node:fs/promises';
+import { spawn } from 'node:child_process';
+import { dirname, resolve, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+
+export const PROJECT_ROOT = resolve(HERE, '..', '..', '..', '..');
+export const FIXTURE_DIR = resolve(PROJECT_ROOT, 'packages/rcf-lite/test/fixtures/probe-pack-edge-cloudflare-turnstile');
+export const REPORT_DIR = resolve(PROJECT_ROOT, '.rcf/reports/blueprints/edge-cloudflare-turnstile');
+
+// Pinned Cloudflare Turnstile public test keys per
+// https://developers.cloudflare.com/turnstile/troubleshooting/testing/.
+export const TEST_SITEKEYS = Object.freeze({
+  alwaysPass: '1x00000000000000000000AA',
+  alwaysBlock: '2x00000000000000000000AB',
+  forcedInteractive: '3x00000000000000000000FF',
+  invisiblePass: '1x00000000000000000000BB',
+  invisibleBlock: '2x00000000000000000000BB',
+});
+export const TEST_SECRETS = Object.freeze({
+  alwaysPass: '1x0000000000000000000000000000000AA',
+  alwaysFail: '2x0000000000000000000000000000000AA',
+  tokenSpent: '3x0000000000000000000000000000000AA',
+});
+export const SITEVERIFY_URL = 'https://challenges.cloudflare.com/turnstile/v0/siteverify';
+
+export function aggregate(results) {
+  if (results.some((r) => r.verdict === 'fail')) return 'fail';
+  if (results.some((r) => r.verdict === 'warn')) return 'warn';
+  return 'pass';
+}
+
+export async function writeReport({ probeName, engine, results, extra }) {
+  await mkdir(REPORT_DIR, { recursive: true });
+  const report = {
+    slug: 'edge-cloudflare-turnstile',
+    probeName,
+    runAt: new Date().toISOString(),
+    engine,
+    results,
+    aggregateVerdict: aggregate(results),
+    ...(extra ?? {}),
+  };
+  const path = resolve(REPORT_DIR, `${probeName}.json`);
+  await writeFile(path, JSON.stringify(report, null, 2) + '\n', 'utf8');
+  return { report, path };
+}
+
+export async function runShim(probeName, engine, mainFn) {
+  try {
+    const { results, extra } = await mainFn();
+    const { report, path } = await writeReport({ probeName, engine, results, extra });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stdout.write(`report written to ${path}\n`);
+    if (report.aggregateVerdict === 'fail') process.exitCode = 1;
+  } catch (err) {
+    const results = [{
+      anchorAcId: 'unknown',
+      verdict: 'fail',
+      detail: `probe threw: ${err && err.message ? err.message : String(err)}`,
+    }];
+    const { report, path } = await writeReport({ probeName, engine, results });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stderr.write(`probe error: ${err && err.stack ? err.stack : String(err)}\n`);
+    process.stderr.write(`report written to ${path}\n`);
+    process.exitCode = 1;
+  }
+}
+
+// Boot the pack fixture on a free port. Returns {url, stop}.
+export async function bootFixture(env = {}) {
+  const child = spawn(process.execPath, ['server.js'], {
+    cwd: FIXTURE_DIR,
+    env: { ...process.env, PORT: '0', ...env },
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  const port = await new Promise((resolveP, rejectP) => {
+    const timer = setTimeout(() => rejectP(new Error('fixture boot timeout')), 8000);
+    let buf = '';
+    child.stdout.on('data', (d) => {
+      buf += String(d);
+      const m = buf.match(/LISTENING (\d+)/);
+      if (m) { clearTimeout(timer); resolveP(Number(m[1])); }
+    });
+    child.stderr.on('data', (d) => { buf += String(d); });
+    child.on('exit', (code) => { clearTimeout(timer); rejectP(new Error(`fixture exited early code=${code}: ${buf}`)); });
+  });
+  return {
+    url: `http://127.0.0.1:${port}`,
+    stop: () => new Promise((resolveP) => { child.once('exit', () => resolveP()); child.kill('SIGTERM'); }),
+    child,
+  };
+}
+
+export async function fixturePost(url, path, body) {
+  const params = new URLSearchParams();
+  for (const [k, v] of Object.entries(body)) params.set(k, String(v));
+  const resp = await fetch(`${url}${path}`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/x-www-form-urlencoded' },
+    body: params,
+  });
+  const text = await resp.text();
+  let json = null;
+  try { json = JSON.parse(text); } catch { /* leave null */ }
+  return { status: resp.status, json, text };
+}
+
+// Recursively walk a directory and return every file path with one of the given extensions.
+export async function collectFiles(root, exts = ['.js', '.mjs', '.cjs', '.ts']) {
+  const out = [];
+  async function walk(dir) {
+    let entries;
+    try { entries = await readdir(dir, { withFileTypes: true }); } catch { return; }
+    for (const e of entries) {
+      if (e.name === 'node_modules' || e.name === 'proof' || e.name === '.git') continue;
+      const p = join(dir, e.name);
+      if (e.isDirectory()) await walk(p);
+      else if (exts.some((x) => e.name.endsWith(x))) out.push(p);
+    }
+  }
+  await walk(root);
+  return out;
+}
+
+export async function readFileText(p) { return readFile(p, 'utf8'); }

package/blueprints/edge-cloudflare-turnstile/contributions/probes/run-event-secrecy.mjs

@@ -0,0 +1,5 @@
+import runProbe from './event-secrecy.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'live-endpoint', image: 'Cloudflare siteverify endpoint via probe-pack-edge-cloudflare-turnstile fixture; event sink asserted for secrecy', healthy: true };
+runShim('event-secrecy', engine, runProbe);

package/blueprints/edge-cloudflare-turnstile/contributions/probes/run-guard-shape-scan.mjs

@@ -0,0 +1,5 @@
+import runProbe from './guard-shape-scan.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'source-tree-plus-live', image: 'source AST scan plus live POST against probe-pack-edge-cloudflare-turnstile fixture', healthy: true };
+runShim('guard-shape-scan', engine, runProbe);

package/blueprints/edge-cloudflare-turnstile/contributions/probes/run-secret-shape-scan.mjs

@@ -0,0 +1,5 @@
+import runProbe from './secret-shape-scan.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'source-tree', image: 'AST-shaped source scan over probe-pack-edge-cloudflare-turnstile fixture', healthy: true };
+runShim('secret-shape-scan', engine, runProbe);

package/blueprints/edge-cloudflare-turnstile/contributions/probes/run-siteverify-fixture.mjs

@@ -0,0 +1,5 @@
+import runProbe from './siteverify-fixture.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'live-endpoint', image: 'Cloudflare siteverify endpoint challenges.cloudflare.com/turnstile/v0/siteverify via probe-pack-edge-cloudflare-turnstile fixture', healthy: true };
+runShim('siteverify-fixture', engine, runProbe);

package/blueprints/edge-cloudflare-turnstile/contributions/probes/secret-shape-scan.mjs

@@ -0,0 +1,77 @@
+// Probe: TURNSTILE_SECRET is read only via env-shaped identifiers; no non-test-key secret literal in the pack fixture source.
+// anchorAcId: AC-35107-1. accountBound: false.
+//
+// The pack fixture pins the Cloudflare public test keys as environment defaults so the pack does not need real Turnstile credentials
+// to run (spec section 3.2). The test keys are documented at https://developers.cloudflare.com/turnstile/troubleshooting/testing/
+// and are public per Cloudflare; the scan allows those literals only and refuses any other secret-shaped literal.
+
+export const anchorAcId = 'AC-35107-1';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const { FIXTURE_DIR, TEST_SECRETS, collectFiles, readFileText } = await import('./probe-utils.mjs');
+  const results = [];
+
+  const files = await collectFiles(FIXTURE_DIR, ['.js', '.mjs', '.cjs']);
+  // 1. Every TURNSTILE_SECRET reference must be an env-shaped read (process.env.TURNSTILE_SECRET).
+  const envReadPattern = /process\.env\.TURNSTILE_(?:SECRET|FAIL_SECRET|SITEKEY|INVISIBLE_SITEKEY|INVISIBLE_BLOCK_SITEKEY|BLOCK_SITEKEY|FORCED_SITEKEY|WIDGET_MODE|GUARDED_SURFACES)\b/;
+  const bareRefPattern = /\bTURNSTILE_SECRET\b/g;
+
+  let envReadCount = 0;
+  let bareRefCount = 0;
+  const bareRefLocations = [];
+
+  for (const file of files) {
+    const src = await readFileText(file);
+    const bare = [...src.matchAll(bareRefPattern)];
+    for (const m of bare) {
+      const window = src.slice(Math.max(0, m.index - 40), m.index + m[0].length);
+      if (window.match(envReadPattern)) envReadCount++;
+      else {
+        const lineStart = src.lastIndexOf('\n', m.index) + 1;
+        const lineEnd = src.indexOf('\n', m.index);
+        const line = src.slice(lineStart, lineEnd === -1 ? src.length : lineEnd);
+        const beforeCommented = line.slice(0, m.index - lineStart).includes('//');
+        if (beforeCommented || line.trim().startsWith('//') || line.trim().startsWith('*')) continue;
+        bareRefCount++;
+        bareRefLocations.push({ file: file.replace(FIXTURE_DIR + '/', ''), line: src.slice(0, m.index).split('\n').length });
+      }
+    }
+  }
+
+  results.push({
+    anchorAcId: 'AC-35107-1',
+    verdict: (envReadCount >= 1 && bareRefCount === 0) ? 'pass' : 'fail',
+    detail: (envReadCount >= 1 && bareRefCount === 0)
+      ? `TURNSTILE_SECRET is read only via env-shaped identifiers; envReads=${envReadCount}, bareOutsideEnvFacade=0, filesScanned=${files.length}`
+      : `TURNSTILE_SECRET bare references outside process.env facade: ${JSON.stringify(bareRefLocations)}`,
+  });
+
+  // 2. No non-pinned-test secret literal appears in source. Cloudflare public test keys (documented on
+  // https://developers.cloudflare.com/turnstile/troubleshooting/testing/) are the ONLY secret-shaped
+  // literals allowed as env defaults per spec section 3.2.
+  const allowedTestSecrets = new Set(Object.values(TEST_SECRETS));
+  // A secret-shaped literal is a 30-char-or-longer alphanumeric string sitting inside single or double quotes.
+  const secretLiteralPattern = /["']([A-Za-z0-9_-]{30,})["']/g;
+  const leaks = [];
+  for (const file of files) {
+    const src = await readFileText(file);
+    let m;
+    while ((m = secretLiteralPattern.exec(src)) !== null) {
+      const lit = m[1];
+      if (allowedTestSecrets.has(lit)) continue;
+      // Ignore obvious non-secrets: URLs (contain slashes), function names.
+      if (lit.startsWith('http') || lit.includes('/')) continue;
+      leaks.push({ file: file.replace(FIXTURE_DIR + '/', ''), fragment: lit.slice(0, 8) + '...' });
+    }
+  }
+  results.push({
+    anchorAcId: 'AC-35107-1',
+    verdict: leaks.length === 0 ? 'pass' : 'fail',
+    detail: leaks.length === 0
+      ? `only Cloudflare public test secrets appear as env defaults (allowed per Cloudflare testing docs); no other secret-shaped literal found in ${files.length} files`
+      : `unexpected secret-shaped literal in fixture source: ${JSON.stringify(leaks)}`,
+  });
+
+  return { results, extra: { filesScanned: files.length, allowedTestSecretCount: allowedTestSecrets.size } };
+}

package/blueprints/edge-cloudflare-turnstile/contributions/probes/siteverify-fixture.mjs

@@ -0,0 +1,53 @@
+// Probe: server-side siteverify with pinned always-pass secret returns success:true;
+// with pinned always-fail secret returns success:false. anchorAcId: AC-35102-1. accountBound: false.
+// Drives the LIVE Cloudflare siteverify endpoint per spec section 3.1 (real-engine rule)
+// with the public test keys documented at
+// https://developers.cloudflare.com/turnstile/troubleshooting/testing/.
+
+export const anchorAcId = 'AC-35102-1';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const { TEST_SECRETS, SITEVERIFY_URL, bootFixture, fixturePost, TEST_SITEKEYS } = await import('./probe-utils.mjs');
+  const results = [];
+
+  // Pass branch: drive siteverify with always-pass secret via the shipped verifier
+  const passFixture = await bootFixture({ TURNSTILE_SECRET: TEST_SECRETS.alwaysPass, TURNSTILE_SITEKEY: TEST_SITEKEYS.alwaysPass });
+  try {
+    const passResp = await fixturePost(passFixture.url, '/api/submit', {
+      email: 'reviewer@example.com',
+      'turnstile-sitekey': TEST_SITEKEYS.alwaysPass,
+      'cf-turnstile-response': 'XXXX.DUMMY.TOKEN.XXXX',
+    });
+    const okPass = passResp.status === 200 && passResp.json && passResp.json.received === 'ok';
+    results.push({
+      anchorAcId: 'AC-35102-1',
+      verdict: okPass ? 'pass' : 'fail',
+      detail: okPass
+        ? `siteverify pass via ${SITEVERIFY_URL} with always-pass secret returned success:true; fixture /api/submit responded status=200 body=${JSON.stringify(passResp.json)}`
+        : `siteverify pass unexpected shape status=${passResp.status} body=${passResp.text}`,
+    });
+  } finally { await passFixture.stop(); }
+
+  // Fail branch: drive siteverify with always-fail secret; handler must reject with 400 and errorCodes
+  const failFixture = await bootFixture({ TURNSTILE_SECRET: TEST_SECRETS.alwaysFail, TURNSTILE_SITEKEY: TEST_SITEKEYS.alwaysBlock });
+  try {
+    const failResp = await fixturePost(failFixture.url, '/api/submit', {
+      email: 'reviewer@example.com',
+      'turnstile-sitekey': TEST_SITEKEYS.alwaysBlock,
+      'cf-turnstile-response': 'XXXX.DUMMY.TOKEN.XXXX',
+    });
+    const errorCodes = failResp.json && failResp.json.errorCodes;
+    const codesOk = Array.isArray(errorCodes) && errorCodes.length > 0;
+    const okFail = failResp.status === 400 && failResp.json && failResp.json.errorCode === 'turnstile.siteverify-failed' && codesOk;
+    results.push({
+      anchorAcId: 'AC-35102-1',
+      verdict: okFail ? 'pass' : 'fail',
+      detail: okFail
+        ? `siteverify fail via ${SITEVERIFY_URL} with always-fail secret returned success:false; fixture /api/submit responded status=400 errorCode=turnstile.siteverify-failed errorCodes=${JSON.stringify(errorCodes)}`
+        : `siteverify fail unexpected shape status=${failResp.status} body=${failResp.text}`,
+    });
+  } finally { await failFixture.stop(); }
+
+  return { results };
+}

package/blueprints/edge-cloudflare-turnstile/contributions/requirements/edge-cloudflare-turnstile-req-001.json

@@ -0,0 +1,17 @@
+{
+  "reqId": "edge-cloudflare-turnstile-REQ-001",
+  "prdId": "PRD-001",
+  "title": "Client widget mount: an elicited sitekey renders the Turnstile widget and the mount injects no third-party script beyond Cloudflare Turnstile JS host",
+  "description": "The applying project reaches Cloudflare Turnstile through a client widget mount that renders on elicited surfaces using the elicited TURNSTILE_SITEKEY. The mount injects only Cloudflare Turnstile JS from the Cloudflare Turnstile host (https://challenges.cloudflare.com/turnstile/v0/api.js per https://developers.cloudflare.com/turnstile/) and no other third-party script. On submit the widget populates a hidden Cf-Turnstile-Response token field the form payload carries.",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.5). Ships as v1.0.0 of edge-cloudflare-turnstile.",
+  "tags": [
+    "blueprint:edge-cloudflare-turnstile"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-07T20:00:00.000Z",
+  "updatedAt": "2026-09-07T20:00:00.000Z"
+}

package/blueprints/edge-cloudflare-turnstile/contributions/requirements/edge-cloudflare-turnstile-req-002.json

@@ -0,0 +1,17 @@
+{
+  "reqId": "edge-cloudflare-turnstile-REQ-002",
+  "prdId": "PRD-001",
+  "title": "Server-side siteverify: POST to https://challenges.cloudflare.com/turnstile/v0/siteverify with the elicited secret; success:true proceeds, failure rejects 400",
+  "description": "The applying project verifies every Turnstile response token server-side by POSTing {secret: TURNSTILE_SECRET, response: token} to https://challenges.cloudflare.com/turnstile/v0/siteverify. On success:true the handler proceeds; on success:false the handler rejects with 400 and the refusal body carries the documented error-codes value, not the sitekey or the secret.",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.5). Ships as v1.0.0 of edge-cloudflare-turnstile.",
+  "tags": [
+    "blueprint:edge-cloudflare-turnstile"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-07T20:00:00.000Z",
+  "updatedAt": "2026-09-07T20:00:00.000Z"
+}